Overlay networking in OT builds a virtual network layer on top of the existing physical infrastructure using encrypted tunnels and identity-based traffic steering. It delivers segmentation, access control, and encrypted communication without touching the underlying switches, routers, or cabling, which is exactly what makes it viable on brittle industrial networks.
What is overlay networking in OT?
An overlay is a software-defined network that rides on the physical network it sits above. The physical network, called the underlay, keeps doing its job of moving packets. The overlay adds a second logical network on top, one where membership is based on cryptographic identity rather than which switch port a device happens to occupy.
That shift is the whole idea. On a traditional flat OT network, plugging in gets you access. On an overlay, a device is invisible and unreachable until it authenticates and is authorized into a segment, no matter where it is physically connected.
How does overlay networking work?
The overlay creates logical point-to-point tunnels between enrolled devices. Each device runs a lightweight agent or, for legacy gear that cannot, connects through a local gateway appliance. Traffic bound for another overlay member is encrypted, encapsulated inside standard IP packets, and sent across the underlay. The far end decapsulates and decrypts before handing traffic to the destination application.
Overlays in OT typically assign addresses from the 100.64.0.0/16 CGNAT range reserved by IANA. That range does not collide with the RFC 1918 private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) already running on production OT networks, so the overlay adds addressing without forcing a renumber. Because topology is defined in software, two devices in different buildings or on different subnets can share one segment, while two devices on the same switch can be walled off from each other.
How is overlay networking different from a VLAN?
The difference is the enforcement layer. A VLAN operates at Layer 2 and depends on switch port configuration and 802.1Q tags. Any device on the right port joins the VLAN, identity unchecked. An overlay operates at Layer 3 or above and binds access to cryptographic identity, so a device has to authenticate before it can join, regardless of its physical port.
It also differs from a classic VPN. A remote-access VPN typically drops a user onto a network segment with broad reach. An overlay places each device into a specific, least-privilege segment and keeps east-west traffic encrypted and controlled, not just the tunnel to the edge.
Why does overlay networking suit brownfield OT?
Brownfield OT is unforgiving. Production networks have decades of organic growth, undocumented dependencies, and IP addresses hard-coded into PLC programs, HMI configs, and historian connection strings. Change one address and you may have to revalidate an entire control loop.
Overlay networking sidesteps all of it. The physical network is untouched. Devices keep their existing addresses for legacy traffic and get a second overlay-scoped address for protected communication, so a device can talk to legacy systems on the underlay while sitting in an identity-enforced segment on the overlay. Deployment needs no downtime: a gateway connects to a spare switch port, devices are enrolled one at a time, and each enrollment is independently reversible, which fits OT change windows.
Who uses overlay networking in OT?
Operators who cannot rebuild their networks but still need segmentation. A pharmaceutical plant with systems validated under FDA 21 CFR Part 11 can add access control without triggering a revalidation cycle, because the underlay the validated systems depend on never changes. In oil and gas, wellhead controllers scattered across a shared MPLS network can be grouped into logical security zones that span the physical topology without touching the carrier's MPLS configuration.
Why does overlay networking matter for compliance?
It satisfies segmentation and boundary-protection requirements without a physical rebuild. NIST SP 800-171 boundary protection and information-flow enforcement are met by overlay-enforced policy. IEC 62443 zones and conduits map cleanly onto overlay segments. CMMC Level 2 enclave requirements are satisfied by identity-enforced overlay boundaries, and NIS2 segmentation obligations are addressed with no change to the underlay.
How Access Gate helps
Access Gate deploys overlay networking in OT using the lollipop architecture, creating identity-enforced segments in the 100.64.0.0/16 range without modifying the physical underlay. See What is overlay networking.
